Affected version: 4.8.x (the option was broken in 4.7, working fine in 4.6)

We use pss.localroot to restrict the directories available to clients via proxies, but it turns out that the path restriction is not honored on recent XRootD versions:

The following file sits outside the configured pss.localroot but can happily be accessed by clients:

xrdfs xrdcmstzero6.cern.ch:1094 stat /store/mc/RunIISummer17PrePremix/Neutrino_E-10_gun/GEN-SIM-DIGI-RAW/MC_v2_94X_mc2017_realistic_v9-v1/40005/C0482830-37C9-E711-B00A-0242AC130002.root
Path:   /store/mc/RunIISummer17PrePremix/Neutrino_E-10_gun/GEN-SIM-DIGI-RAW/MC_v2_94X_mc2017_realistic_v9-v1/40005/C0482830-37C9-E711-B00A-0242AC130002.root
Id:     223196565536001
Size:   4148278104
MTime:  2017-11-16 05:40:15
Flags:  16 (IsReadable)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

{"api_version":"1.0","publisher":{"api_key":"05dde50f1d1a384dd78767c55493e4bb","name":"GitHub"},"entity":{"external_key":"github/xrootd/xrootd","title":"xrootd/xrootd","subtitle":"GitHub repository","main_image_url":"https://cloud.githubusercontent.com/assets/143418/17495839/a5054eac-5d88-11e6-95fc-7290892c7bb5.png","avatar_image_url":"https://cloud.githubusercontent.com/assets/143418/15842166/7c72db34-2c0b-11e6-9aed-b52498112777.png","action":{"name":"Open in GitHub","url":"https://github.com/xrootd/xrootd"}},"updates":{"snippets":[{"icon":"DESCRIPTION","message":"pss.localroot not honored (#650)"}],"action":{"name":"View Issue","url":"https://github.com/xrootd/xrootd/issues/650"}}}

Use REPLY-ALL to reply to list

To unsubscribe from the XROOTD-DEV list, click the following link:
https://listserv.slac.stanford.edu/cgi-bin/wa?SUBED1=XROOTD-DEV&A=1